Cookie theft

Session cookies stolen via XSS, sniffing or malware

categoryWeb and application attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1539 · Steal Chrome v127+ cookies via Remote Debugging (Windows) · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1539 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1539 -TestGuids b647f4ee-88de-40ac-9419-f17fac9489a7 -TimeoutSeconds 120'

ATT&CK T1539 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1539 -Tool atomic -RunId run-2026-10-11-002 -Command 'Invoke-AtomicTest T1539 -TestGuids b647f4ee-88de-40ac-9419-f17fac9489a7 -TimeoutSeconds 120'

ATT&CK T1539 · Chromium launched with --remote-debugging-port by a script parent (CDP cookie-theft signature, Windows / Sysmon EID1)

powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\cdp-launch-probe.ps1 -Technique T1539 -RunId <run-id>

+ 1 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-17 · detected in 1s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Pass-the-cookie via Chrome DevTools Protocol: Chromium launched with --remote-debugging by a non-interactive parent (v127+ app-bound-encryption bypass)
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
Security · EID 4624	Non network or service local logon.
Security · EID 4625	Logon Failure - Unknown user or bad password
Security · EID 4634	Non service account logged off.
Security · EID 4672	Special privileges assigned to new logon.

Detection that fired

✓ Wazuh 100203 (level 10) lab rule — Pass-the-cookie via Chrome DevTools Protocol: Chromium launched with --remote-debugging by a non-interactive parent (v127+ app-bound-encryption bypass)

Plus 5 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~417 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-11

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
Security · EID 4672	Special privileges assigned to new logon.

Plus 7 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100200, 100201, 100202 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~226 incidental alerts/hour — tune against this.

2 public Sigma rule(s) also target this technique.

Classification

35 values: 10 reviewed, 3 lab-measured, 14 imported, 8 derived. What do these mean?

Exploitability

Attack vector	Credential attacksSoftware vulnerabilities
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	Passive
Attacker skill required	High
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSOffice SuiteSaaSWindows
Environment	CloudMobileOn-premises
Target asset class	IdentityWeb app / API
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team testCustom lab test
Data sources (ATT&CK data components)	Application Log ContentFile AccessFile ModificationLogon Session CreationProcess AccessProcess CreationUser Account Authentication

Detection & response

Mitigated by 15

M1017 attack-mitigation
M1021 attack-mitigation
M1032 attack-mitigation
M1047 attack-mitigation
M1051 attack-mitigation
M1054 attack-mitigation
D3-ANCI d3fend
D3-CCSA d3fend
D3-CH d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DUC d3fend
D3-MFA d3fend
D3-RIC d3fend

Detected by 4

DET0509 attack-detection-strategy
24c77512-782b-448a-8950-eddb0785fc71 sigma
4833155a-4053-4c9c-a997-777fcea0baa7 sigma
100203 wazuh

Tested by 6

26a6b840-4943-4965-8df5-ef1f9a282440 atomic
4b437357-f4e9-4c84-9fa6-9bcee6f826aa atomic
b647f4ee-88de-40ac-9419-f17fac9489a7 atomic
e43cfdaf-3fb8-4a45-8de0-7eee8741d072 atomic
e57ba07b-3a33-40cd-a892-748273b9b49a atomic
lab-custom-cdp-launch-probe-win other

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-11-002`	partially-detected	atomic	windows	2026-10-11
`run-2026-10-17-001`	detected	other	windows	2026-10-17

run-2026-10-11-002 — atomic_tests=5 public_sigma_rules=2 caldera=not-indexed; expected=0 incidental=14 max_level=15 dwell_s=90
run-2026-10-17-001 — E2 probe for Wazuh rule 100203 (pass-the-cookie via the Chrome DevTools Protocol). Generates ONLY the Sysmon EID1 process-create signature the rule keys on (msedge.exe launched with --remote-debugging-port by a non-browser parent); reads no cookies, drives no DevTools socket, connects to nothing, and kills msedge within ~2.5s. The t1539-atomic test (b647f4ee) is the same CDP idiom but launches chrome.exe, which the clean win-victim lacks (no EID1 -- run-2026-10-16-005 parked as a rig artifact); rule 100203 also matches msedge.exe, which ships on Windows 11, so the built-in Edge measures 100203 install-free. Hand-written (coexists with t1539-atomic, like t1021.004-custom-windows-ssh); the file-read rules 100200-100202 stay on the atomic entry.; expected=1 incidental=11 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1539/
attack: T1539 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Web and application attacks' table, line 258 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 29 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-11) — Lab detonation run-2026-10-11-002 (partially-detected) for T1539: no alert matched the expected technique
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-17) — Lab detonation run-2026-10-17-001 (detected): Wazuh rule(s) 100203 fired on T1539 within the detonation window
Pass-the-cookie via Chrome DevTools Protocol: Chromium launched with --remote-debugging by a non-interactive parent (v127+ app-bound-encryption bypass)